How do I include the search results in the scheduled search email?
I have a scheduled search that looks for errors in the logs every hour and emails them to me if it finds any. A couple of months ago, when it found an error, the offending log message was included in the body of the email, which was extremely useful. Now, while I still get the email, it forces me to log in to see what actually went wrong. I doubt that it's something i changed on my end.... though I guess you never know for sure. Can this be changed back to the way it was?
Joe
-
Hi Kumar,
Yes, I am definitely doing an aggregation. It worked before though.... I suppose I don't need it, though it is nice for when I run the query by hand. Do I need to take it out? Here's the exact query:
(((_source=application AND exception OR "[ERROR]") AND !"from android") AND !"from ios") AND !_sourceCategory=Grocery/CloudFront AND !_sourceCategory=Grocery/Chef | timeslice by 30m | count by _timeslice
Please sign in to leave a comment.
Comments
4 comments